npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 722
Updated 28 Oct 2026, 03:35 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4143 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4143 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...
OpenSSF/OSV malware advisory MAL-2026-4599 blocks this version. Package name mimics the widely-used `license-checker` while shipping an undocumented `lib/compliance.js` module that harves...
OpenSSF/OSV malware advisory MAL-2026-6070 blocks this version. OSV/OpenSSF confirms libsc-runtime-telemetry@0.1.0 as malicious package MAL-2026-6070. Malicious code in libsc-runtime-tele...
OpenSSF/OSV malware advisory MAL-2026-4598 blocks this version. The package is published as a generic logging library but configures a pino-loki transport whose destination defaults to ht...
OpenSSF/OSV malware advisory MAL-2026-6065 blocks this version. OSV/OpenSSF confirms lab-services@99.0.0 as malicious package MAL-2026-6065. Malicious code in lab-services (npm)
OpenSSF/OSV malware advisory MAL-2026-6167 blocks this version. The npm package `lazyloading-haptics` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Nativ...
OpenSSF/OSV malware advisory MAL-2026-6167 blocks this version. The npm package `lazyloading-haptics` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Nativ...
OpenSSF/OSV malware advisory MAL-2026-3331 blocks this version. The package lazyhtml-scripts was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-4346 blocks this version. Part of a multi-package malicious campaign by npm author `toskypi`, `logger-draft` is a companion package to `eo-terminal`...
OpenSSF/OSV malware advisory MAL-2026-4346 blocks this version. Part of a multi-package malicious campaign by npm author `toskypi`, `logger-draft` is a companion package to `eo-terminal`...
OpenSSF/OSV malware advisory MAL-2026-4346 blocks this version. Part of a multi-package malicious campaign by npm author `toskypi`, `logger-draft` is a companion package to `eo-terminal`...
OpenSSF/OSV malware advisory MAL-2026-4822 blocks this version. On `npm install`, the package's preinstall hook executes index.js, which collects host identifiers (hostname, username, pla...
OpenSSF/OSV malware advisory MAL-2026-4600 blocks this version. Package advertises itself via a verbatim copy of pino's README, docs/, and index.d.ts (TypeScript types and documentation a...
OpenSSF/OSV malware advisory MAL-2026-4600 blocks this version. Package advertises itself via a verbatim copy of pino's README, docs/, and index.d.ts (TypeScript types and documentation a...
OpenSSF/OSV malware advisory MAL-2026-5744 blocks this version. loadninja-shared@9.9.99 is a dependency-confusion package targeting an internal/private package namespace. package.json dec...
OpenSSF/OSV malware advisory MAL-2026-4634 blocks this version. package.json declares `preinstall: node index.js`, which runs automatically on `npm install`. index.js collects host identi...
OpenSSF/OSV malware advisory MAL-2026-4633 blocks this version. package.json declares `"preinstall": "node index.js"`, causing index.js to run automatically on `npm install`. index.js col...
OpenSSF/OSV malware advisory MAL-2026-6193 blocks this version. Package impersonates the legitimate sorted-btree library (matching name, README, and attributed author) and ships a hidden...
OpenSSF/OSV malware advisory MAL-2026-4632 blocks this version. On require()/import, index.js collects host identifiers (os.hostname(), os.userInfo().username, os.platform(), os.arch(), p...
OpenSSF/OSV malware advisory MAL-2026-3373 blocks this version. The package owa-analytics-utils was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-4630 blocks this version. scripts/postinstall.js runs unconditionally during `npm install`. When the `opencode` binary is not on PATH (true for nearl...
OpenSSF/OSV malware advisory MAL-2026-4630 blocks this version. scripts/postinstall.js runs unconditionally during `npm install`. When the `opencode` binary is not on PATH (true for nearl...
OpenSSF/OSV malware advisory MAL-2026-4630 blocks this version. scripts/postinstall.js runs unconditionally during `npm install`. When the `opencode` binary is not on PATH (true for nearl...
OpenSSF/OSV malware advisory MAL-2026-4630 blocks this version. scripts/postinstall.js runs unconditionally during `npm install`. When the `opencode` binary is not on PATH (true for nearl...